Imports DotNetNuke.Entities.Portals
Imports DnnSecurity.Results

Namespace Checks
    Public Class DataBasePermission
        Inherits MultilingualBase
        Implements IDnnSecurityCheck


        Public ReadOnly Property DisplayName As String Implements IDnnSecurityCheck.DisplayName
            Get
                Return GetTranslationFor (Me.GetType.Name & ".DisplayName")
            End Get
        End Property

        Private _ShortInfoText As String

        Public ReadOnly Property ShortInfoText() As String Implements IDnnSecurityCheck.ShortInfoText
            Get
                Return GetTranslationFor (Me.GetType.Name & ".ShortInfoText")
            End Get
        End Property

        Public ReadOnly Property Description() As String Implements IDnnSecurityCheck.Description
            Get
                Return GetTranslationFor (Me.GetType.Name & ".Description")
            End Get
        End Property

        Public ReadOnly Property SecurityRiskClassification As SecurityRiskClassification _
            Implements IDnnSecurityCheck.SecurityRiskClassification
            Get
                Dim res As IDnnSecurityResult =
                        Results.OrderByDescending (Function(x) x.SecurityRiskClassification).FirstOrDefault
                If res IsNot Nothing Then
                    Return res.SecurityRiskClassification
                End If

                Return SecurityRiskClassification.Ok
            End Get
        End Property

        Private _results As New List(Of IDnnSecurityResult)

        Public ReadOnly Property Results() As List(Of IDnnSecurityResult) Implements IDnnSecurityCheck.Results
            Get
                Return _results
            End Get
        End Property

        Public Sub Execute (ByVal portalSettings As PortalSettings, ByVal result As IAsyncResult) _
            Implements IDnnSecurityCheck.Execute
            Dim sql As String = ""

            sql = "SELECT @@SPID AS 'ID', SYSTEM_USER AS 'LoginName', USER AS 'UserName'"
            'Get current executing user

            Dim dt1 As DataTable = DnnSecuritySQL.DirectQuery (sql)

            If dt1.Rows.Count > 0 Then

                Dim user As String = CType (dt1.Rows (0).Item ("UserName"), String)
                'user name

                'check user role
                sql =
                    String.Format (
                        "SELECT USER_NAME(memberuid) AS [USER], USER_NAME(groupuid) AS [GROUP] FROM sys.sysmembers WHERE USER_NAME(groupuid) IN ('db_owner', 'db_accessadmin') AND USER_NAME(memberuid) = '{0}'",
                        user)
                dt1 = DnnSecuritySQL.DirectQuery (sql)

                If dt1.Rows.Count > 0 Then
                    Dim group As String = CType (dt1.Rows (0).Item ("GROUP"), String)
                    Me.Results.Add (New DataBaseAdmin (group))
                End If

            End If

        End Sub

        Public Overloads Sub LoadRessourceFile (ByVal fileName As String) Implements IDnnSecurityCheck.LoadRessourceFile
            MyBase.LoadRessourceFile (fileName)
        End Sub
    End Class
End Namespace

